Picture this: you are on a security team, and you have been asked to shortlist a vendor that will find, test and protect your company's APIs. You open the apis.io Security area to see who is in it, and you expect the names you already know to sit near the top.
They do not. The area ranks 30 providers, and they split cleanly into two groups. The first is 21 API-security specialists, the companies that test, discover, protect and govern other people's APIs. Twenty of them are scored, and they average 24.4 on the Kin Score. The second is nine general platforms that do security as part of a broader business. They average 75.4. All nine are exemplar. None of the specialists is.
Look at the names. Cloudflare scores 80.6, Paubox 77.0 and Aembit 72.6, all exemplar. Among the specialists, the best is Upwind at 52.1, followed by Pynt at 51.8, CyCognito at 46.6 and Detectify at 41.6. Below that the scores fall fast: Traceable is at 31.9, Imperva 31.5, Akto 28.2 and 42Crunch 26.0. PortSwigger is at 20.1 with five APIs, Invicti 15.3, Salt Security 11.2 and Signal Sciences 11.0.
There are gaps beyond the scores. Seven specialists publish zero APIs on the catalog: Akto, Vorlon, Operant, CrossLayer Labs, Raspire, Hex Security and Tinfoil Security. tcell.io has no score at all. Agent Readiness shows the same split, only sharper. Eight of the specialists, PortSwigger, Invicti and Salt Security among them, are at 0.6 or lower.
Here is the part you should sit with. These are the companies telling the market that an API without an inventory, a contract and an auth model is a risk. 42Crunch's whole category is OpenAPI contract auditing. Salt, Traceable, Akto and Imperva sell API discovery on the premise that undocumented APIs are where the breaches are. On their own public surfaces, most of them have not done for their APIs what they sell.
Before you write anyone off, the post is careful about what the number means. Many of these products are consoles bought by security teams, and their management APIs often sit behind a customer tenant. The Kin Score measures only the public surface, so a gated API reads as a thin one. Some of these companies, like Imperva and Signal Sciences, have also been absorbed into larger estates. A low score is not proof that nothing exists behind the login.
Even so, the post argues the gap is not structural. Pynt and Upwind reached the developing band with two to four public contracts. So it can be done by a specialist, and most have not done it.
The nine exemplars share something too. Elastic and the ELK stack (77.6 and 77.0), Snyk (79.1), OneTrust (71.7), Clerk (70.3), Amazon VPN (73.1) and the three in the table publish contracts as a product, not as a sales asset.
The catalog also files a defect against itself. The area's frontmatter says provider_count is 915 and lists 915 slugs, but only 30 providers are ranked rows, and the overview text says 30. Either the membership is 915 and the rankings are truncated, or the slug list is overbroad. One of those two numbers is wrong, and the page should not show both. If you are leaning on the area for your shortlist, treat the 30 as the ranked set and the 915 as unresolved.
So what do you take away? When you evaluate a security vendor, look at what it publishes about itself. Ask for an OpenAPI for the management API, documented auth scopes and an error model, the same things it would ask of you. The post puts it plainly: a security vendor at 11.2 is a pitch that is hard to make, while one at 60 is a reference architecture. And keep the caveat in your pocket: a thin public surface may mean a gated one, so ask before you conclude.
Read the original: https://apis.io/2026/10/21/the-security-area-the-companies-that-sell-api-security-average-24-on-their-own-apis/